Zohocorp
Page 2 of 6 — Zohocorp CVEs from a corpus of 599, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-36485 | High | 8.3 | 2024-11-04 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option. |
CVE-2024-48878 | High | 8.3 | 2024-11-04 | Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report. |
CVE-2024-5608 | High | 8.3 | 2024-10-24 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the technician reports feature. |
CVE-2024-38868 | High | 7.6 | 2024-08-30 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: befor… |
CVE-2024-6204 | High | 8.3 | 2024-08-30 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module. |
CVE-2024-5546 | High | 8.3 | 2024-08-28 | Zohocorp ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are affected by authenticated SQL Injection vulne… |
CVE-2024-41150 | Medium | 6.3 | 2024-08-23 | An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This… |
CVE-2024-38869 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Cen… |
CVE-2024-5586 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option. |
CVE-2024-5556 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module. |
CVE-2024-5490 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in aggregate reports option. |
CVE-2024-5467 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report. |
CVE-2024-5466 | High | 8.8 | 2024-08-23 | Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the… |
CVE-2024-36517 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in alerts module. |
CVE-2024-36516 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different fr… |
CVE-2024-36515 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different fr… |
CVE-2024-36514 | High | 8.3 | 2024-08-23 | Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in file summary option. |
CVE-2024-5527 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration. |
CVE-2024-5487 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option. |
CVE-2024-36518 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard. |
CVE-2024-36035 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording. |
CVE-2024-36034 | High | 8.3 | 2024-08-12 | Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option. |
CVE-2024-5678 | Medium | 4.7 | 2024-08-01 | Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature. |
CVE-2024-38872 | High | 8.3 | 2024-07-26 | Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module. |
CVE-2024-38871 | High | 8.3 | 2024-07-26 | Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module. |
CVE-2024-5471 | High | 8.8 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys. |
CVE-2024-27311 | Medium | 5.5 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the… |
CVE-2024-27313 | Medium | 6.3 | 2024-05-29 | Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability. This vulnerability is applicable only in the version 6610. |
CVE-2024-36037 | Medium | 5.5 | 2024-05-27 | Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session recordings. |
CVE-2024-36036 | Medium | 4.2 | 2024-05-27 | Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modifying the agent co… |
CVE-2024-27310 | Medium | 5.3 | 2024-05-27 | Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input. |
CVE-2024-27314 | Low | 2.4 | 2024-05-27 | Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in th… |
CVE-2024-21791 | Medium | 4.7 | 2024-05-22 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability. |
CVE-2023-49335 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details. |
CVE-2023-49334 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report. |
CVE-2023-49333 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature. |
CVE-2023-49332 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares. |
CVE-2023-49331 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option. |
CVE-2024-27312 | High | 8.1 | 2024-05-20 | Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This… |
CVE-2023-49330 | High | 8.3 | 2024-05-20 | Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data. |
CVE-2024-21775 | High | 8.3 | 2024-02-16 | Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature. |
CVE-2024-0269 | High | 8.3 | 2024-02-02 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown. This issue has been fixed and re… |
CVE-2024-0253 | High | 8.3 | 2024-02-02 | ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in home Graph-Data. |
CVE-2023-48793 | Critical | 9.8 | 2024-02-02 | Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature. |
CVE-2023-48792 | Critical | 9.8 | 2024-02-02 | Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option. |
CVE-2023-50785 | Low | 2.7 | 2024-01-25 | Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal. |
CVE-2023-49943 | Medium | 5.4 | 2024-01-18 | Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet. |
CVE-2024-0252 | High | 8.8 | 2024-01-11 | ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component… |
CVE-2023-47211 | Critical | 9.1 | 2024-01-08 | A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbi… |
CVE-2023-50891 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Forms Form plugin for WordPress – Zoho Forms allows… |
CVE-2023-48646 | High | 7.2 | 2023-11-22 | Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings. |
CVE-2023-6105 | Medium | 5.5 | 2023-11-15 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user wit… |
CVE-2023-4769 | Medium | 6.6 | 2023-11-03 | A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability coul… |
CVE-2023-4768 | Medium | 6.1 | 2023-11-03 | A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inje… |
CVE-2023-4767 | Medium | 6.1 | 2023-11-03 | A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inje… |
CVE-2023-41904 | Medium | 5.4 | 2023-09-27 | Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs. |
CVE-2023-38743 | High | 7.2 | 2023-09-11 | Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine. |
CVE-2023-35719 | Medium | 6.8 | 2023-09-06 | ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physi… |
CVE-2023-39912 | Medium | 4.9 | 2023-08-31 | Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed. |
CVE-2023-35785 | High | 8.1 | 2023-08-28 | Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7… |
CVE-2023-31492 | Medium | 6.5 | 2023-08-17 | Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticate… |
CVE-2020-27449 | Medium | 6.1 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute ar… |
CVE-2023-38333 | Medium | 6.1 | 2023-08-10 | Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in. |
CVE-2023-32783 | High | 7.5 | 2023-08-07 | The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a… |
CVE-2023-38332 | Medium | 6.5 | 2023-08-04 | Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure. |
CVE-2023-29505 | Medium | 4.3 | 2023-08-04 | An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking. |
CVE-2023-38331 | Medium | 5.4 | 2023-07-28 | Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module. |
CVE-2023-37308 | Medium | 5.4 | 2023-07-07 | Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field. |
CVE-2023-34197 | Medium | 5.4 | 2023-07-07 | Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerabili… |
CVE-2023-35786 | Medium | 4.9 | 2023-07-05 | Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files. |
CVE-2023-35854 | Critical | 9.8 | 2023-06-20 | Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity… |
CVE-2023-31099 | High | 8.8 | 2023-05-04 | Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers. |
CVE-2023-2291 | High | 7.8 | 2023-04-26 | Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine… |
CVE-2023-29443 | Medium | 4.9 | 2023-04-26 | Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmi… |
CVE-2023-29442 | Medium | 6.1 | 2023-04-26 | Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS. |
CVE-2023-29084 | High | 7.2 | 2023-04-13 | Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. |
CVE-2023-28341 | Medium | 6.1 | 2023-04-11 | Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious java… |
CVE-2023-28340 | Medium | 6.5 | 2023-04-11 | Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack. |
CVE-2023-28342 | High | 7.5 | 2023-04-05 | Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API. |
CVE-2022-43473 | Medium | 5.8 | 2023-03-30 | A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can… |
CVE-2022-36413 | Critical | 9.1 | 2023-03-23 | Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications. |
CVE-2023-26601 | High | 7.5 | 2023-03-06 | Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow De… |
CVE-2023-26600 | Medium | 6.5 | 2023-03-06 | ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privi… |
CVE-2022-48362 | High | 8.8 | 2023-02-25 | Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, aut… |
CVE-2023-0169 | Medium | 5.4 | 2023-02-13 | The Zoho Forms WordPress plugin before 3.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2023-23078 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets. |
CVE-2023-23077 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment. |
CVE-2023-23076 | Critical | 9.8 | 2023-02-01 | OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules. |
CVE-2023-23075 | Medium | 6.1 | 2023-02-01 | Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation. |
CVE-2023-23074 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component. |
CVE-2023-23073 | Medium | 6.1 | 2023-02-01 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component. |
CVE-2023-22964 | Critical | 9.1 | 2023-01-20 | Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled. |
CVE-2022-47966 | Critical | 9.8 | 2023-01-18 | Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka… |
CVE-2023-22624 | High | 7.5 | 2023-01-17 | Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks. |
CVE-2022-47523 | Critical | 9.8 | 2023-01-05 | Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection. |
CVE-2022-47578 | High | 7.1 | 2022-12-20 | An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on US… |
CVE-2022-47577 | High | 7.1 | 2022-12-20 | An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on US… |
CVE-2022-40772 | Medium | 6.5 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report mod… |
CVE-2022-40771 | Medium | 4.9 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure. |
CVE-2022-40770 | High | 7.2 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users. |